Keep GitHub Actions and dependencies up to date with Dependabot, with a cooldown #295

🌀 Claude: The workflows pin GitHub Actions by major version, and several are behind: for example, actions/checkout@v4, astral-sh/setup-uv@v5 and actions/cache@v4 in .github/workflows/ci.yml. Nothing updates them on a schedule.

Proposal: add a .github/dependabot.yml that opens grouped updates for:

• the github-actions ecosystem;
• possibly uv (uv.lock) and cargo (Cargo.lock) as well.

Give each a cooldown, so a release must be a few days old before Dependabot proposes it. That avoids picking up a release that is yanked or compromised soon after publishing. CU-DBMI's uv template is an example.

Related: GitHub currently reports 109 Dependabot alerts on main (2 critical, 37 high), at https://github.com/xqlsystems/xarray-sql/security/dependabot. Grouped version updates would also show which of them a lock bump clears.

Raised in review of #269.